I collect and use personal information so that I can respond to enquiries, provide therapy, keep appropriate clinical records, manage appointments and payments, meet legal and professional responsibilities and practise safely and ethically.

My full privacy notice explains what information I collect, how I use it, where it is stored, how long I keep it, when information may need to be shared, your data protection rights, and how to raise a concern about how your information has been handled.

I do not use Artificial Intelligence (“AI”) using client data or for client notes.  I may use AI for marketing and websites. 

Privacy Notice

August 2026

WB Counselling
Williamina Baillie, MBACP Accred.

Counselling Professional Body

I am a member of the British Association for Counselling & Psychotherapy (BACP) and work in accordance with its Ethical Framework for the Counselling Professions.

The current BACP Ethical Framework is available on the BACP website.

Client Personal Information and Data Protection

Any personal information I gather is stored securely, using password protection and other appropriate security measures.

Personal information is used to enable effective communication and to provide therapy safely, ethically and professionally. I only collect and store personal information that is relevant and necessary to the therapeutic relationship and the running of my practice.

I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Confidentiality

Therapy is confidential, but confidentiality is not absolute.

It may become necessary to share information if I believe there is a serious risk of harm to you or someone else, or where there is a safeguarding concern. I may also need to share information where I am required to do so by law, court order or legal process, or where disclosure is necessary to protect life or prevent or detect a serious crime.

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so where this would increase risk, prejudice safeguarding action or would otherwise not be possible.

I may also discuss aspects of your therapy with my clinical supervisor as part of my professional responsibility to maintain safe and effective practice. I aim to minimise identifying information wherever possible and appropriate.

Personal Information I Hold

You have the right to know what personal information I hold, why I hold it, how it is stored, who may have access to it and how long I keep it.

I may collect and hold the following information where it is relevant to providing therapy and managing my practice:

1. Personal information

This may include your name, address, date of birth, pronouns, contact details and other information needed to work safely and professionally with you.

This information is stored securely and is accessible only to me, except where information needs to be shared for a lawful, ethical or safeguarding reason.

2. Phone number and email address

I may hold your phone number and email address so that I can contact you about appointments, changes to sessions, invoices or other matters relating to our work.

Electronic devices I use are password protected and are not shared with other people.

I may retain contact information for as long as necessary for the purposes for which it was collected and in accordance with my retention arrangements.

3. Emergency contact information

If you choose to provide an emergency contact, I will hold their name and contact details securely.

I would only use this information where there was a genuine reason to do so, such as a serious concern about your welfare and I was unable to contact you.

I would normally discuss the purpose of an emergency contact with you when this information is provided.

4. Health and other relevant information

If you share information about your health, mental health or wellbeing, I may record information that is relevant to our work.

This may include information that is important for your wellbeing or safety during therapy, or information that helps me understand your circumstances and the reasons you are seeking counselling.

I only collect information that is relevant and necessary for providing therapy safely and professionally.

5. Clinical notes

I may keep brief clinical notes to support safe and effective therapy.

These notes are kept proportionately and may include session dates, brief themes discussed, relevant risk or safeguarding information, agreed actions or important decisions.

I do not keep a full transcript of therapy sessions.

6. Payment information and invoices

I keep records of payments and invoices for the purposes of managing my business and meeting tax and accounting requirements.

Financial records are retained for the period required by law.

Where payment is made by BACS, your account name, payment reference or the name of the person making the payment may appear on my bank statements.

Payments are processed through my bank and may be accessible to the bank as part of its normal banking processes.

7. Emails, texts and messages

I may use email, SMS or WhatsApp to communicate with you about appointments and other practical matters relating to therapy.

I may delete routine messages when they are no longer required. I may retain correspondence where I consider it necessary for the therapeutic relationship, administration of my practice, safeguarding or professional record keeping.

Electronic correspondence may also be stored by the relevant service provider.

8. Website

My website does not contain personal information about my clients.

If you use the contact form or email link on my website, the information you provide may be collected and sent to my email account so that I can respond to your enquiry.

How Long I Keep Information

I keep personal information only for as long as necessary for the purpose for which it was collected.

As a general guide:

• information relating to enquiries where therapy does not begin may be deleted after a reasonable period, usually within 6 to 12 months
• client records may be kept for three years after therapy ends
• financial records are kept for the period required for tax and accounting purposes
• emails, messages and administrative information are reviewed periodically and deleted when no longer needed

There may be circumstances where information needs to be kept for longer, for example because of legal, safeguarding, insurance or complaint-related requirements.

I keep my retention arrangements under review and aim to ensure that information is retained only for as long as there is a justified reason to do so.

Sharing Information

I will not share your personal information unless there is a clear, lawful and appropriate reason to do so.

Depending on the circumstances, information may be shared with:

• my clinical supervisor
• professional advisers such as an accountant, insurer or legal adviser
• safeguarding or emergency services where necessary
• your GP where there is a serious risk or safeguarding concern and sharing information is necessary and appropriate
• a court or other legal authority where required by law
• trusted service providers who process information on my behalf

Where information is shared, I aim to share only what is relevant and necessary for the purpose.

Where Your Information Is Stored

Information may be stored securely using systems including:

• WordPress for my website and contact form
• Gmail for email
• Microsoft Word for clinical and practice records
• Zoom, Google Meet or Microsoft Teams for online sessions
• Starling for payments and banking
• Apple iCloud for cloud storage or backup
• SMS and WhatsApp for telephone and message communication

I use appropriate technical and organisational measures to protect personal information. These may include password protection, device security, two-factor authentication, restricted access and secure storage.

External service providers may process information on my behalf. I aim to use reputable providers with appropriate security and data protection arrangements.

Online Therapy

If we work online, sessions may take place using Zoom, Google Meet or Microsoft Teams.

I take reasonable steps to protect confidentiality from my side. I ask that you also choose a private place where you cannot easily be overheard or interrupted.

Online platforms may process technical information such as your IP address, device information or connection data. You can review the privacy notice of the platform we use for further information.

AI Tools, Transcription and Recording

I do not record or transcribe therapy sessions and I do not use AI tools to process therapy sessions.

I may use digital tools for general practice administration, writing, planning or education. I take confidentiality and data protection into account when deciding how these tools are used and do not put identifiable client material into tools that are not appropriate for confidential clinical information.

Website Visitors and Cookies

When you visit my website, some technical information may be collected automatically. This may include your IP address, device type, browser type, pages visited and the time of your visit.

My website is hosted by Bluehost and may use cookies or similar technologies for website functionality, security, performance or analytics.

You can usually control cookies through your browser settings. Where cookies or similar technologies require notice or consent under applicable law, I will provide this as required.

Your Rights

Under UK data protection law, you have rights relating to your personal information. Depending on the circumstances, these may include the right to:

• be informed about how your information is used
• request access to the personal information I hold about you
• ask for inaccurate information to be corrected
• ask for information to be deleted in certain circumstances
• restrict or object to certain processing
• complain about how your information has been handled

These rights are not absolute and may be subject to legal or other limitations.

For example, I may need to retain certain information for legal, professional, safeguarding, insurance or complaint-related reasons. There may also be circumstances where information cannot be disclosed because it contains information about another person or a relevant legal exemption applies.

If you would like to exercise any of your rights, please contact me using the details below.

Data Protection Concerns and Complaints

If you have a concern about how I have handled your personal information, please contact me first using the details below.

I will consider your concern and take appropriate steps to investigate it without undue delay.

If you are not satisfied with my response, you can contact the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

Data Controller

For the purposes of UK data protection law, the data controller for the personal information I collect and process in connection with my practice is:

Williamina Baillie – WB Counselling

If you have any questions about how your personal information is collected, stored or processed, please contact me at:

Email: wbctherapy@gmail.com
Website: https://wbcounselling.com

Changes to this Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.

The latest version will be available on my website.

Privacy Notice – August 2026